Tag Archives: Supply Chain Integrity

Supply chain integrity and security: what are the risks? (Part I)

Posted on by

Paul Curwell, CPP, CFE, CISSP

Introduction

Supply Chains are complex involving many levels of suppliers who are typically located in multiple countries around the world. For high reliability industries (such as airlines and oil rigs) or industries where there is a chance of life or death (e.g. defence applications, pharmaceuticals and food products), the introduction of a sub-standard or below specification (non-conforming) product could have serious consequences. Further, many of these industries are highly regulated to protect consumers.

Photo by Markus Spiske on Pexels.com

The nature of global supply chains today presents a real challenge, as illustrated by the global supply chain for the Boeing 787 and Bombardier Global Express in this article from Canada’s Aerospace Review. These challenges are magnified somewhat in relation to security and integrity risks, as explored later in this article. To assist readers unfamiliar with these concepts, a simple product supply chain could be considered as having at least eight categories of actors, as illustrated below:

An illustative example of a simple supply chain

Part I of this article addressses the concept of Supply Chain Integrity. Part II, continued here, examines what we mean by the concept of Supply Chain Security, and how the field is evolving in response to the world’s changing geostrategic climate. Supply Chain Integrity and Security’ (SCIS) is part of the broader domain of Supply Chain Risk Management (SCRM), which is undergoing its own renaissance thanks to COVID-19 and the associated distruptions to global trade and commerce arising from the pandemic.

Does this article resonate with you? Please vote below or subscribe to get updates on my future articles

What is Supply Chain Integrity and Security?

The concepts of Supply Chain Integrity and Supply Chain Security are often bundled together under the guise of Supply Chain Integrity and Security (SCIS). One example of this is in the life sciences industry, with the following defintion of SCIS being commonly cited from the U.S. Pharmacopea (a compendium of drug information, effectively the standards for all pharmaceutical compounds in the USA whose application is enforced by the US Food and Drug Administration):

Supply Chain Integrity and Security (SCIS) is defined as a set of policies, procedures, and technologies used to provide visibility and traceability of products within the supply chain. This is done to minimize the end-user’s exposure to adulterated, economically motivated adulteration, counterfeit, falsified, or misbranded products or materials, or those which have been stolen or diverted. This is minimized by implementing procedures to control both the forward and the reverse supply chains. SCIS involves reducing risks that arise anywhere along the supply chain, from sourcing materials and products to their manufacture and distribution. The ultimate goal is to detect adulterated, falsified, or counterfeit products and prevent them from entering the supply chain.

Supply Chain Integrity defined

Supply Chain Integrity is sufficiently different from Supply Chain Security to require its own explanation. Supply Chain Integrity is defined by ENISA as providing an “indication of the conformance of the supply chain to good practices and specifications associated with its operations”. When I think about what this means in plain english, I deconstruct the concept of Supply Chain Integrity into three core elements:

  • Provenance – What are the origins of all components or raw materials in my product? For example, a ‘blood diamond’ extracted illegally from a war zone using slave labour is still an authentic diamond, however its provenance is questionable.
  • Authenticity – Is the product what it claims to be, or has it been tampered with or substituted? Have the products or components been “produced with legal right or authority granted by the legally authorized source” (AS6174A)?
  • Traceability – Can I trace the movement of components in my product from raw material to the end user? This is defined in AS6174A as “having documented history of material’s supply chain history. This refers to documentation of all supply chain intermediaries and significant handling transactions, such as from original manufacturer to distributor”
Photo by Pixabay on Pexels.com

As I previously discussed in this article on SAE’s standard AS6174 and which are worth reproducing again here, the World Economic Forum identified “four key questions that must be answered at the product level as part of Supply Chain Integrity (Pickard & Alvarenga, 2012):

  • Integrity of Source – did this product come from where I think it did?
  • Integrity of Content – is the product made the way I think it is?
  • Integrity of Purpose – is the product going to do what I think it will do?
  • Integrity of Channel – did this product travel the way I think it did?”

To address each of the elements of Provenance, Authenticity and Traceability, Supply Chain Integrity programs typically comprise a variety of activities, including:

  • Track and trace programs as well as serialisation to uniquely identify each component and locate where it resides globally in the supply chain at any point in time
  • Quality management programs, to identify conforming vs. non-conforming products
  • Supplier integrity programs, to understand exactly who the seller of a product, part or raw material is and assess what if any integrity risks this poses
  • Market surveillance (market monitoring) – intelligence activities to identify where products are being sold and by whom, to manage the risk of counterfeit or diverted products to end users and the manufacturer’s brand or reputation
Photo by Pixabay on Pexels.com

A taxonomy of Supply Chain Integrity risks

As with any type of risk, it is possible to build a taxonomy of individual risks which reside under the category of Supply Chain Integrity. Based on my research, I have listed fourteen risks associated with Supply Chain Integrity below:

  • Adulteration of products or raw materials
  • Tampering of products, parts or components
  • Introduction of counterfeit material
  • Gray market products
  • Substitution of raw materials, parts, components or products
  • Falsified or fraudulent material
  • Use of substandard material (i.e. non-conforming or below specification)
  • Misbranded or falsely-labelled products
  • Expired products (moved to less-regulated jurisdiction, re-labelled, and then re-sold)
  • Products marked for destruction are diverted, re-labelled then re-sold
  • Ineffective product recall
  • Ineffective product storage and / or transport
  • Supplier integrity

These risks are related to, but also quite different to the risks listed in Part II of this article on Supply Chain Security (see link at the bottom of the page).

The relationship between Supply Chain Integrity and your Quality Management System

I have mentioned the term ‘conformance’ a number of times throughout this document, which is defined by ISO22000 as “a product which filfils a requirement”. Conformance assumes that a buyer goes to market seeking to procure products or services which do a particular thing or meet a particular standard (the requirements), and that a supplier is contractually obligated to provide a product or service which addresses these requirements.

Photo by Karolina Grabowska on Pexels.com

For buyers, Quality Management Systems (QMS) play an important role in ensuring the products which are shipped to your door for use are firstly what you purchased (hopefully addressing your requirements), and secondly what they claim to be. This process is referred to in AS6174A as ‘Product Assurance’ which involves “confirming the authenticity of materiel or its compliance with manufacturer’s specifications” (SAE International, p27) to minimise the likelihood of non-conforming materiel entering the supply chain. Product Assurance is undertaken using one of four methods listed below:

  • Documentation & Packaging Inspection
  • Visual Inspection
  • Non-Destructive Testing (NDT)
  • Destructive Testing (DT)

Readers wanting more information on the Product Assurance process can refer to my previous article. In many organisations, the Product Assurance process is typically performed by a combination of warehouse personnel and / or engineers, scientists or quality management teams upon delivery of new parts or products. Alternately, other organisations perform these inspections before a product leaves the factory, ensuring adequate SCIS processes are in place to mitigate any security or integrity risks that may arise between the shipment leaving the factory and delivery to its final destination.

Failure to properly perform Product Assurance may mean company takes receipt of a non-conforming product or component on day 1, however that this non-conformance is not identified until the product or component is placed into service (potentially some days later). This gap between delivery date and usage date may be an extended period of time during which warranties or guarantees may become voided. Risks here are particularly high for business critical or hard to source parts held in inventory as spares in the event of an in-service part failure, which could provide a false sense of security that sufficient spares are held in case of emergency.

To read Part II of this article, click here.

Further Reading

DISCLAIMER: All information presented on ForewarnedBlog is intended for general information purposes only. The content of ForewarnedBlog should not be considered legal or any other form of advice or opinion on any specific facts or circumstances. Readers should consult their own advisers experts or lawyers on any specific questions they may have. Any reliance placed upon ForewarnedBlog is strictly at the reader’s own risk. The views expressed by the authors are entirely their own and do not represent the views of, nor are they endorsed by, their respective employers. Refer here for full disclaimer.

Vendor Fraud: what is it?

Posted on by

Paul Curwell, CPP, CFE, CISSP

Are there fraud risks associated with vendors?

Every public and private sector organisation today has a requirement to outsource some or all aspects of their operations, whether it be purchasing supplies or equipment, engaging a managed (outsourced) service provider to run its IT helpdesk or security operations centre, our purchasing tangible products or raw materials for its operations. Managing these capabilities takes a lot of effort and typically requires a specialist team aside from the procurement function to manage key relationships day to day.

Photo by fauxels on Pexels.com

We all know that relationships are difficult by their nature, and business relationships are no different to those in our personal lives. Sometimes, however, relationships deteriorate substantially to the point of potential litigation or where those relationships may be severed. Common triggers for this includes upstream supply or quality control issues, breaches of confidentiality, and fraud.

What is fraud?

The Commonwealth Fraud Control Policy defines fraud as ‘dishonestly obtaining a benefit, or causing a loss, by deception or other means’. As defined here, a benefit can be non-material or material benefit, tangible or intangible. Benefits may also be obtained by a third party. Examples of fraud relating to vendors include:

  • theft
  • accounting fraud (e.g. false invoices, misappropriation)
  • causing a loss, or avoiding and/or creating a liability
  • providing false or misleading information
  • failing to provide information when there is an obligation to do so
  • misuse of assets, equipment or facilities
  • making, or using, false, forged or falsified documents
  • wrongfully using confidential information or intellectual property.

Business to business fraud is a problem which remains largely off the radar – many businsess have problems with their vendors or business partners, but these rarely end up in court or in the media. Frequently, even when a business relationship goes wrong, the parties to the relationship still need each other and will work to rebuild trust that has been lost where an alternate supplier or partner is not available.

One important note on vendors is that they form part of your organisation’s inner circle: they are trusted insiders who, by virtue of this status, have privileged access to your organisation, its products, information, services, systems, facilities and people beyond that of the ordinary public. It is critical that vendors be considered as part of your Insider Threat Management Program, as well as in your Supply Chain Security, Integrity and Fraud Program. Where there are overlaps in coverage in these programs, this should be harmonised.

Associations with irreputable vendors can also damage your organisation’s reputation, and potentially introduce the risks of civil or criminal action as well as shareholder activism. One example here is where a vendor is involved in modern slavery, and your organisation’s due diligence program has not detected this in advance.

Photo by Rolled Alloys Specialty Metal Supplier on Pexels.com

What is the vendor fraud landscape?

Vendor fraud can be defined as fraud involving a vendor that occurs at any point in the supplier process, which is:

  • Supplier selection
  • Contracting
  • Operations
  • Termination

The Association of Certified Fraud Examiners (ACFE) notes that vendor fraud can occur in anything from billing to delivery of supplies, and can be broadly grouped in two categories. Vendor frauds involving trusted insiders, such as employees and contractors, can occur indepedent of the vendor or in collusion with them. There are also various types of vendor frauds perpetrated without the involvement of insiders. These range from what we might call ‘soft frauds’, such as subtly charging the wrong hourly rate or claiming travel expenses when not applicable, through to more serious problems like product substitution. A high level taxonomy of vendor fraud is shown below:

Vendor frauds involving insidersExternal vendor frauds
Billing schemes (invoicing)Labour fraud schemes (for outsourced services)
Corruption schemes (e.g. kickbacks, bribery, conflicts of interest)Travel fraud schemes
Fraud schemes involving materials
Shell companies and pass through schemes
Hidden subcontractor schemes
ACFE – high level vendor fraud taxonomy

As you can see, there is a wide spectrum of vendor frauds – the ACFE’s training course on vendor fraud, referenced below, is a great starting point for someone new to this area. Some are specific to particular types of work – such as labour and travel fraud schemes more prominent with the outsourcing of services.

Vendor fraud versus supply chain integrity: what’s the difference?

As the focus of @forewarnedblog is on protection and integrity of critical technologies, supply chains, IP, products, brands and marketplaces, I would be remiss if I did not cover vendor fraud schemes involving materials and ‘supply chain integrity’ in more detail.

The term ‘supply chain integrity’ is being used increasingly in common language to reflect whether business (as opposed to retail consumers) buyers have ‘got what they paid for’ in relation to materials (products). As consumers, when we buy a product (the material) we expect it to meet certain quality or provinance (origin) standards, such as those advertised by the seller or manufacturer. In countries like Australia, many of these requirements are also enshrined in consumer law. If a product breaks or fails, or if it is poor quality such as paint peeling off, then we feel disappointed and probably worse. It is business’ responsibility to make sure this outcome doesn’t happen for its consumers, which is where a Supply Chain Integrity program comes in.

A Supply Chain Integrity program aims to “mitigate the risk end-user’s exposure to adulterated, economically motivated adulteration, counterfeit, falsified, or misbranded products or materials, or those which have been stolen or diverted” (The United States Pharmacopeial Convention, 2016). These programs apply to both buyers and sellers, but the focus differs depending on where you sit in a supply chain.

Photo by cottonbro on Pexels.com

The overlap with vendor fraud lies with what ACFE refers to as “fraud schemes involving materials“, where risks such as product substitution (a buyer pays for a product meeting one set of specifications, but it is substituted for a cheaper, lower quality, alternate or less functional model which might be less reliable or functional for the user). Typically, the trust a consumer places in a product or service is also wrapped up in the seller’s brand – if we see a product for sale from a brand we trust, we might buy it without question. Commonly, Supply Chain Integrity is bundled with Supply Chain Security into a consolidated ‘Supply Chain Integrity and Security’ program (SCIS), as seen in the global pharmaceutical industry.

Typically, an SCIS program focuses on both upstream supply (i.e. ensuring substandard products or raw materials do not infiltrate your supply chain as an input to say manufacturing), and downstream to ensure that counterfeits and diverted products do not enter a supply chain through nodes such as authorised distributors. In contrast, vendor fraud programs are typically narrower in scope.

What does this mean in practice?

In my opinion, if you are in an industry with serious life, safety or reputational (‘brand’) risks attached to the quality of materials provided by your suppliers, using a vendor fraud program to manage product substitution fraud risks may not be sufficiently robust or rigorous. Typically these programs focus on whether the vendor supplied a substandard product (i.e. may have defrauded you in terms of your sourcing, purchasing or procurement process) rather than a more holistic program aimed at improving the security and integrity of your supply chain overall (i.e. all products across all vendors). For these industries, a holistic Supply Chain Integrity and Security program (that also addresses the vendor fraud risk of product substitition) is more appropriate.

Photo by cottonbro on Pexels.com

We already see this situation emerging in high reliability industries (e.g. mass transport, pharmaceuticals and medical devices, automotive and aerospace). In Australia, this area is becoming increasingly regulated with amendments to Australia’s Security of Critical Infrastructure (SOCI) Act which covers eleven critical infrastructure sectors and introduces new rules for managing supply chain integrity and security hazards. There’s a lot to unpack in this topic – I will cover some types of vendor fraud, particularly product substitution (sometimes called ‘product fraud’) in future posts.

Further Reading

DISCLAIMER: All information presented on ForewarnedBlog is intended for general information purposes only. The content of ForewarnedBlog should not be considered legal or any other form of advice or opinion on any specific facts or circumstances. Readers should consult their own advisers experts or lawyers on any specific questions they may have. Any reliance placed upon ForewarnedBlog is strictly at the reader’s own risk. The views expressed by the authors are entirely their own and do not represent the views of, nor are they endorsed by, their respective employers. Refer here for full disclaimer.

The USP/APEC ‘Supply Chain Security Toolkit for Medical Products’

Posted on by

Author: Paul Curwell

Introduction

In a previous post, I looked at the anti-counterfeiting and supply chain traceability model proposed by AS6174 for the Aviation and Defence industries. This standard is one of many different standards available, some of which are generically applicable to any industry, and others which are designed to meet the needs of a particular target audience.

This article continues with the current Supply Chain Integrity and Security theme, this time looking at the model developed by the The United States Pharmacopeial Convention (USP) – Asia Pacific Economic Cooperation (APEC) Life Sciences Innovation Forum (LSIF) in 2016.

The United States Pharmacopeial Convention defines Supply Chain Integrity and Security as “a set of policies, procedures, and technologies used to provide visibility and traceability of products within the supply chain. This is done to minimize the end-user’s exposure to adulterated, economically motivated adulteration, counterfeit, falsified, or misbranded products or materials, or those which have been stolen or diverted”.

On first glance, the output of the USP/APEC model is what is referred to as the ‘Supply Chain Security Toolkit for Medical Products’, designed for the pharmaceutical, medical devices, and life sciences industry. This toolbox addresses ten different domains, each of which has a range of sub-components, which align nicely into a Capability Maturity Model that at a high level could be applicable to a range of industries.

In this post, I unpack this USP/APEC toolbox in more detail and explain how the Toolkit could be applied to create an industry-agnostic Capability Maturity Model for Supply Chain Integrity and Security.

Photo by Anna Tarazevich on Pexels.com

The USP/APEC ‘Supply Chain Security Toolkit for Medical Products’

This toolkit itself is a 14-page interactive PDF broken into ten domains, each of which reflects a different element of the supply chain.  There are 64 supporting documents from a variety of authors, including the World Health Organisation and APEC, which dive into each element in differing levels of detail. This is available on the Korean National Institute of Food and Drug Safety’s website. The ten elements are as follows:

Good Manufacturing PracticesThis section sets out 11 key considerations for supply chain integrity and security in any manufacturing process. Aside from processes like Outsourcing and Repackaging, which are recognised as vulnerable to a variety of supply chain threats from product tampering, to cargo theft, product substitution, product diversion, and grey market / parallel import activity, this section also introduces the concept of “show and shadow factories”.
Used here, ‘shadow factories’ refer to businesses which actually perform the manufacturing process (or elements of it), without being declared as such. Aside from the Supply Chain Integrity and Security risks, these practices also expose organisations to Bribery & Corruption risks (such as the Foreign and Corrupt Practices Act and United Kingdom Bribery Act) and Modern Slavery and Human Trafficking risks (such as were workers in ‘shadow factories’ may be trafficked or working in slavery, slave-like, harmful or substandard conditions). See my related posts on modern slavery and associated due diligence practices here.
Good Distribution PracticesThis section, along with the Good Manufacturing Practices, is comprehensive and well-constructed. Whereas the real insights the remaining sections are somewhat buried in the supporting documents, this section is cleanly laid out to reflect the steps required across 11 elements of the distribution value chain.
Good Import / Export PracticesUnfortunately this section remains under development so no further guidance or information is available on importing and exporting
Clinical and Retail Pharmacy PracticesThis section is interesting because of its focus on the ‘end user’ [see my previous post for details on end user verification], covering the lifecycle from “purchase and receipt to storage, and until the products are dispensed and administered”. The supporting guidance includes another 66-page toolkit which is similar in terms of application to AS6174, as well as incorporating similar concepts around traceability of raw materials and storage as the Australian Code of Good Manufacturing Practice for Veterinary Chemical Products.
Product SecurityThe term ‘product security’ appears undefined in the Toolkit, yet seems to refer to the variety of measures used to protect products from “cargo theft, intentional adulteration, Product Diversion, Substandard Products [what I refer to as Product Substitution], and Product Tampering. The materials in this section provide advice on both “upstream” and “downstream” issues in the supply chain.
Detection TechnologyThis section focuses on giving parties in the supply chain the ability to determine the Authenticity and Conformance (including Quality) of any product, with a view to identifying what USP/APEC define as ‘Substandard, Spurious, Falsely Labelled, Falsified and Counterfeit’ (SSFFC) medical products through non-destructive (e.g authentication of packaging) and destructive testing (e.g. chemical analysis) methods. One observation from me is the different language used across industries – whilst this life sciences example uses SSFFC, readers of my previous post may recall that AS6174 used “suspected, fraudulent, and counterfeit” to refer to the same concepts.
Internet salesThe global, unregulated nature of online shopping is a long-standing concern for any Intellectual Property Rights (IPR) Holder, let alone life sciences. TheToolkit highlights a variety of risks to consumers arising from internet sales, including: “(a) not receiving the drug purchased; (b) drugs containing incorrect dosage, i.e. super-potent or sub-potent; (c) or containing no active ingredient at all”. A fourth category, that of containing harmful or toxic ingredients as substitutes (e.g. arsenic), could also be added given this practice is common with many counterfeit pharmaceuticals – see this article published in 2019 from The Guardian.
Track and Trace SystemThe life sciences industry has a range of industry-specific, regulated requirements around ‘track and trace systems’ such as those mandated by the United States Drug Supply Chain Security Act (DSCSA). Usefully, this Toolkit contains a Gap Assessment documenting selected best practices as well as cost-benefit information that may be of use in any business case.
Surveillance and MonitoringThis element is split into the typical Prevent, Detect and Respond domains common in any security or fraud risk management framework and is primarily focused at the government, as opposed to manufacturer, level. The government focuses likely explains why this model does not address the utility of an ‘intelligence capability’ as a foundation to Identify and Monitor threats before they become material to business. I will cover this in more detail in future posts.
Single Points of ContactThis aspect focuses on building a public-private network for information exchange between regulators, authorities, law enforcement agencies and international bodies. In addition to emphasising reporting, this domain also addresses the need for training and cooperation programs.
Photo by Alexandros Chatzidimos on Pexels.com

Using the Toolkit to build a Capability Maturity Model for Supply Chain Integrity & Security

As outlined above, this is a comprehensive, free toolkit for a highly regulated industry that goes into a substantial amount of detail as to the programs and initiatives that should comprise any Supply Chain Integrity and Security framework for the life sciences sector. The attraction of this Toolkit is that it could be easily converted into a Capability Maturity Model and applied across any industry with similar supply chain risks, such as food & beverages, consumer electronics, or agricultural chemicals.

Whilst subtle industry and jurisdiction-specific differences will exist, any reader charged with the task of reviewing or developing a Supply Chain Integrity and Security program could easily apply the contents of this Toolkit to this task. Additionally, Internal Auditors and functional leads (e.g. Heads of Product or Heads of Security) could benefit from using the Toolkit to benchmark their current programs.

Photo by Anna Shvets on Pexels.com

Benchmarking & Capability Maturity Models

Any benchmarking activity should start with the construction of a Capability Maturity Model – effectively a deconstruction of all the major elements in any Supply Chain Integrity and Security framework (e.g. manufacturing, distribution, product security, etc), which identifies each of the sub-elements that comprise each of the major elements. Organisations which lack either a major or sub-element would ordinarily be considered less mature, receiving a lower ‘current state’ score, unless there is a justifiable business need for not performing a particular function.

I have been building and applying Capability Maturity Models since 2006 when I joined Booz Allen Hamilton, and I can personally attest to the tremendous value of Capability Maturity Models in helping functional leads understand what needs to feature on strategic roadmaps or workplans. Just as important as the design of the Capability Maturity Model is what is defined as the ‘target state’ – importantly, you don’t need to have the highest capability maturity score for every major or sub-element. In some cases, a low score may be justifiable.

The whole point of a Capability Maturity Model is to build a capability that meets your strategic and operational requirements, as opposed to having a great capability that is not required given the business’ operational footprint. Capabilities which exceed business requirements can be a waste of money and may be a target for cost reduction or outsourcing.

Further reading

DISCLAIMER: All information presented on ForewarnedBlog is intended for general information purposes only. The content of ForewarnedBlog should not be considered legal or any other form of advice or opinion on any specific facts or circumstances. Readers should consult their own advisers experts or lawyers on any specific questions they may have. Any reliance placed upon ForewarnedBlog is strictly at the reader’s own risk. The views expressed by the authors are entirely their own and do not represent the views of, nor are they endorsed by, their respective employers. Refer here for full disclaimer.

Unpacking AS6174 in relation to Supply Chain Integrity

Posted on by

Author: Paul Curwell

Introduction

Product counterfeiting is a global fraud problem that has been steadily evolving for decades, with no product or industry being immune. In 2015, Frontier Economics estimated “the value of international and domestic trade in counterfeit and pirated goods in 2013 was $710 -$ 917 Billion” (2015). The magnitude of this problem is also reflected in US and EU Customs seizures, which continue to grow (Smith, 2016). Unfortunately, Customs agencies can only seize what they know about, placing the onus on the purchaser to exercise adequate due diligence and supply chain risk management practices.

In 2007, the US Department of the Navy tasked the US Department of Commerce’ Bureau of Industry & Security to conduct an assessment of counterfeit electronics across the US defence industrial base, concluding “all elements of the supply chain have been directly impacted by counterfeit electronics” (2010). Similar findings across other branches of the US Government have triggered a range of Supply Chain Integrity and Security initiatives, one of which is Supply Chain Integrity.

The concept of Supply Chain Traceability

Supply Chain Traceability is critically important as a control to achieve Supply Chain Integrity in safety or high-reliability industries such as Aviation or Healthcare, where the introduction of sub-standard products / components / raw materials (referred to in the standard as ‘materiel’) can ultimately lead to death. Supply Chain Traceability is defined in AS6174 as “having documented history of material’s supply chain history. This refers to documentation of all supply chain intermediaries and significant handling transactions, such as from original manufacturer to distributor” (SAE International, p9), with ‘materiel’ being defined as “material, parts, assemblies and other procured items” (SAE International, p6).

Photo by Alexander Isreb on Pexels.com

This concept of Supply Chain Traceability presented in AS6174 appears akin to the concept of Supply Chain Integrity introduced by the World Economic Forum in 2012, which identified “four key questions that must be answered at the product level as part of Supply Chain Integrity (Pickard & Alvarenga, 2012):

  • Integrity of Source – did this product come from where I think it did?
  • Integrity of Content – is the product made the way I think it is?
  • Integrity of Purpose – is the product going to do what I think it will do?
  • Integrity of Channel – did this product travel the way I think it did?”

The difference between the approach adopted by AS6174 and that of the WEF report is that the standard is, unexpectedly, much more forensic in the way it approaches the concept. Where the WEF principles differ are in their application, which is broader than anti-counterfeiting, and could easily incorporate Environmental / Social / Governance (ESG) and other Sustainability Risk considerations such as Modern Slavery and Illegal Logging as part of a broader focus on Supply Chain Integrity (World Economic Forum, 2015).

Within AS6174, Supply Chain Traceability aims to address the introduction of Suspect, Fraudulent or Counterfeit materiel into the Supply Chain (SAE International, p6). Before proceeding further, it is worth exploring exactly how the introduction of Suspect, Fraudulent or Counterfeit material into the Supply Chain is possible. From my perspective, there are two starting points to this discussion:

Genuine Materials

Genuine materials are used or supplied by the manufacturer, which are subsequently adulterated or compromised, meaning that a legitimate product (referred to in AS6174 as a ‘conforming product’) is transformed into a ‘non-conforming’ (illegitimate) product at some point in the supply chain before it reaches the end user. The transformation from genuine to non-conforming materiel can occur in the supply chain via at least two methods:

  • Product Diversion – where legitimate product is diverted from the authorised supply chain (Bandler & Burke 2009, Datz 2005), impacting the ability of a consumer to rely on a vendors’ warranties around Authenticity and Conformance (SAE International, pp7-10). This can be through theft, but it can also be as a result of sales to seemingly legitimate customers (e.g. OEMs) where that product is then re-sold or passed to a third party, such as a gray marketer (Shulman, 2012)
  • Product Substitution – where a product, or part of a legitimate product, is substituted with non-conforming material (Guide to…2019). The concept of product substitution can be illustrated with a can of house paint. Imagine a paint can with the uppermost quarter consisting of real paint (i.e. conforming materiel). The remaining three-quarters of the paint can is filled with a substitute, or non-conforming materiel, which does not mix with the real paint and is heavier so it stays at the bottom of the can. When a customer receives the paint and looks inside, or perhaps performs testing on the product, they will likely only see the uppermost layer. Provided a sample is taken from this layer, the sample will test positive (i.e. conform with manufacturer’s specifications) and not be detected. Meanwhile, the fraudster who substituted the original for fraudulent product has the opportunity to sell three other cans of paint to unsuspecting consumers for the price of one, less the cost of labeling three unmarked paint cans, pocketing the difference.

Both of the above examples fit the definition of “fraudulent material” under AS6174, which is defined as “suspect material represented to the customer as meeting the customers’ requirements” (SAE International, p6).

Non-Genuine Materials

In the second method, non-genuine materials are used throughout the manufacturing process, resulting in a product that in no way conforms to the specifications or authenticity of the original product itself, other than the application of the victim manufacturers’ Trademarks or branding on the packaging. This is commonly referred to as a counterfeit, or ‘fake’. AS6174 defines counterfeit material as “fraudulent material that has been confirmed to be a copy, imitation or substitute that has been represented, identified, or noted as genuine, and / or altered by a source without legal rights with the intent to mislead, deceive or defraud” (SAE International, p6).

Managing the risks – what does AS6174 suggest?

AS6174 provides guidance across 7 main areas to manage the risks of Suspected, Fraudulent or Counterfeit materiel entering the supply chain. These areas include Product Assurance, Risk Assessments, Contractual Obligations, Purchasing Practices, Traceability Guidance and Reporting / Information Sharing arrangements. The following sections focus in more detail on Product Assurance and the Counterfeiting Risk Assessment. Other elements, such as purchasing and supplier due diligence, will be covered in future posts.

Product Assurance

The purpose of Product Assurance, which effectively involves “confirming the authenticity of materiel or its compliance with manufacturer’s specifications” (SAE International, p27), is minimising the likelihood of non-conforming materiel entering the supply chain. Where it does enter the supply chain, Product Assurance and other elements of AS6174 are designed to facilitate early detection. The standard proposes four elements of any Product Assurance process (SAE International, p27):

  1. Documentation & Packaging Inspection – effectively a review of supplier documentation to trace the history of the product and to review the packaging to confirm it meets expectations around conformance with manufacturer’s specifications. As with all fraud prevention processes, the suggestion of verifying the received documents against the source through means such as confirming the accuracy of serial and batch numbers, is raised.
  2. Visual Inspection – this involves examining the product using various scientific techniques and conditions for the presence of identification markings or traceability indicators.
  3. Non-Destructive Testing (NDT) – involves a variety of tests including radiological, acoustic, thermographic and optical techniques to check the product confirms to specifications without actually destroying or using the materiel itself.
  4. Destructive Testing (DT) – involves analytical chemistry techniques, deformation and metallurgical tests, exposure tests, and functional tests.

Obviously, the performance of some of the above requires access to specialist equipment and / or knowledge (such as details of manufacturer’s markings applied to help prove the authenticity of a product), which may be beyond the reach of some consumers. In this case, businesses in Australia may consider it worthwhile engaging a NATA Accredited laboratory to perform such testing on their behalf. One key principle of AS6174 is that the design of any framework to minimise and / or detect non-conforming parts be risk-based, informed by the likelihood and consequence of a non-conforming part being introduced into the organisation’s supply chain.

Determining Counterfeit Risk

AS6174 suggests that the steps taken to minimise counterfeits in the supply chain, including the extent to which Product Assurance is undertaken, should be driven by both the likelihood and consequence of any “non-mitigated counterfeit item” (SAE International, p13). This means, for example, that greater steps should be taken to prevent counterfeiting in relation to a helicopter engine part than say a ream of paper in the office. The risk rating from this exercise dictates the “degree of traceability required” for that part in the supply chain.

The first element of any counterfeit risk assessment should involve considering the Likelihood, or probability of counterfeiting in that product, industry or market. The guidance provided in AS6174 on how to do this is scant, and does not consider the nature of the counterfeiting threat and the attractiveness of counterfeiting a specific part or materiel to fraudsters or organised crime. In a typical security or fraud management context, the risk assessment is preceded by a Threat Assessment, which identifies potential threat actors (e.g. insiders, organised crime), and determines both their Capability to counterfeit the product or materiel and their Intent. This step, which is missing from AS6174, is in my opinion critical to the risk assessment process for any case where the risk is caused by criminality of a human.

In the absence of performing a threat assessment, it may be possible to rely on informal feedback from others, such as industry groups, competitors or customers, but the quality of their advice is reliant on the processes and tools available to those parties to identify and understand the threat. Given that fraudsters and criminals are financially incentivised to engage in counterfeiting due to the low likelihood of being caught, yet alone detected, it is important to remember that history is not a reliable predictor of the future, and that just because something hasn’t happened before does not mean it will in the future. In my experience, all to often these less mature, ad-hoc approaches to understanding threat provide a false sense of security and may mean risks such as counterfeit parts in a supply chain are not detected because people aren’t looking for them, as opposed to them not being there at all.

One other interesting part of the risk assessment relates to “long term materiel availability” (SAE International, p15) or steps to be taken when a manufacturer stops making something. As part of any Anti-Counterfeiting & Product Protection strategy, manufacturers or Intellectual Property Rights (IPR) Holders will typically perform some degree of market surveillance, to understand where their products are being sold, who the vendor is, and for how much. Market surveillance enables early identification of counterfeit and unlicensed product (e.g. parallel imports) and a facilitates a timely legal response. As products become ‘obsolete’, manufacturers often re-allocate market surveillance and IPR enforcement capabilities towards new products. However, this creates opportunities for sub-standard materiel to enter circulation. Products deemed obsolete by the IPR Holder but which retain their after-market value or are subject to consumer demand in a particular region (e.g. developed versus developing markets) can still be subject to counterfeiting, meaning in these cases market surveillance programs may need to become more targeted rather than ceased completely.

Sources

DISCLAIMER: All information presented on ForewarnedBlog is intended for general information purposes only. The content of ForewarnedBlog should not be considered legal or any other form of advice or opinion on any specific facts or circumstances. Readers should consult their own advisers experts or lawyers on any specific questions they may have. Any reliance placed upon ForewarnedBlog is strictly at the reader’s own risk. The views expressed by the authors are entirely their own and do not represent the views of, nor are they endorsed by, their respective employers. Refer here for full disclaimer.